335
submitted 8 months ago by 0x815@feddit.de to c/europe@feddit.de

Four German military officials discussed what targets German-made Taurus missiles could potentially hit if Chancellor Olaf Scholz ever allowed them to be sent to Kyiv, and the call had been intercepted by Russian intelligence.

According to German authorities, the "data leak" was down to just one participant dialling in on an insecure line, either via his mobile or the hotel wi-fi.

The exact mode of dial-in is "still being clarified", Germany has said.

"I think that's a good lesson for everybody: never use hotel internet if you want to do a secure call," Germany's ambassador to the UK, Miguel Berger, told the BBC this week. Some may feel the advice came a little too late.

Eyebrows were raised when it emerged the call happened on the widely-used WebEx platform - but Berlin has insisted the officials used an especially secure, certified version.

Professor Alan Woodward from the Surrey Centre for Cyber Security says that WebEx does provide end-to-end encryption "if you use the app itself".

But using a landline or open hotel wi-fi could mean security was no longer guaranteed - and Russian spies, it's now supposed, were ready to pounce.

you are viewing a single comment's thread
view the rest of the comments
[-] sepiroth154@feddit.nl 143 points 8 months ago* (last edited 8 months ago)

This doesnt add up... If the software was properly encrypted they shouldn't have been able to carry out a man in the middle attack right?

[-] lurch@sh.itjust.works 8 points 8 months ago

yes, one side has to automatically or manually accept a fake certificate/key to MITM end to end encryption. you know, like when your browser says "certificate error" and you click on advanced->accept anyway or something like that. if the software always accepts or he manually accepted one, the MITM guy can substitute his own encryption key/cert and decrypt and re-encrypt on the fly.

[-] trollercoaster@feddit.de 11 points 8 months ago* (last edited 8 months ago)

If you're looking at who is allowed to issue trusted root certificates in common browsers and operating systems, nobody needs to accept nothing to have every possible man in the middle from every major country's intelligence services already in there.

[-] 4am@lemm.ee 5 points 8 months ago

But that also depends on the issuer that WebEx used. If this really was a MITM without someone fucking up and bypassing a warning, whoever the root CA is issuing for WebEx can no longer be trusted.

More likely they dialed in via mobile rather than use “Computer Audio” and that is easily defeated using a Stingray-type device.

[-] trollercoaster@feddit.de 3 points 8 months ago

Yes, in that case, it most likely was using an insecure channel to directly dial into the conference. Still, the entire certificate infrastructure is mere security theater, unless you're actually going through the trouble of checking every individual certificate yourself.

[-] anlumo@feddit.de 3 points 8 months ago

That’s the open secret of the Web, all security on it is just fake. The list of root certificates is way too long to provide any security.

[-] brbposting@sh.itjust.works 1 points 8 months ago

Think it’s likely to impact people with regular threat models?

Any obvious solutions?

[-] anlumo@feddit.de 2 points 8 months ago

Public WiFi is the main problem, anybody connected to the same WiFi could potentially intercept all of your Web traffic. You could use a VPN to avoid that one.

[-] Natanael@slrpnk.net 2 points 8 months ago

Certificate transparency, pinning, etc

load more comments (8 replies)
load more comments (26 replies)
this post was submitted on 08 Mar 2024
335 points (97.5% liked)

Europe

8326 readers
2 users here now

News/Interesting Stories/Beautiful Pictures from Europe 🇪🇺

(Current banner: Thunder mountain, Germany, 🇩🇪 ) Feel free to post submissions for banner pictures

Rules

(This list is obviously incomplete, but it will get expanded when necessary)

  1. Be nice to each other (e.g. No direct insults against each other);
  2. No racism, antisemitism, dehumanisation of minorities or glorification of National Socialism allowed;
  3. No posts linking to mis-information funded by foreign states or billionaires.

Also check out !yurop@lemm.ee

founded 1 year ago
MODERATORS